Improper access control in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C
Priority LOW 34CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.
Summary
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions), CP-8021 MASTER MODULE (All versions), CP-8022 MASTER MODULE WITH GPRS (All versions). The component allows to activate a web server module which provides unauthenticated access to its web pages. This could allow an attacker to retrieve debug-level information from the component such as internal network topology or connected systems.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00704 53rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | CP-8000 MASTER MODULE WITH I/O -25/+70°C | All versions | — | No fix listed | CNA |
| Siemens | CP-8000 MASTER MODULE WITH I/O -40/+70°C | All versions | — | No fix listed | CNA |
| Siemens | CP-8021 MASTER MODULE | All versions | — | No fix listed | CNA |
| Siemens | CP-8022 MASTER MODULE WITH GPRS | All versions | — | No fix listed | CNA |
- CP-8000 MASTER MODULE WITH I/O -25/+70°C VendorSiemens Affected All versions Fixed in — No fix listed CNA
- CP-8000 MASTER MODULE WITH I/O -40/+70°C VendorSiemens Affected All versions Fixed in — No fix listed CNA
- CP-8021 MASTER MODULE VendorSiemens Affected All versions Fixed in — No fix listed CNA
- CP-8022 MASTER MODULE WITH GPRS VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:cp-8021_master_module_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:cp-8021_master_module:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-25\/\+70_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-25\/\+70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-40\/\+70_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-40\/\+70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:cp-8022_master_module_with_gprs_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Siemens |
| cpe:2.3:h:siemens:cp-8022_master_module_with_gprs:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:cp-8021_master_module_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:cp-8021_master_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-25\/\+70_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-25\/\+70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:cp-8000_master_module_with_i\/o_-40\/\+70_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:cp-8000_master_module_with_i\/o_-40\/\+70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:cp-8022_master_module_with_gprs_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Siemens
- cpe:2.3:h:siemens:cp-8022_master_module_with_gprs:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-46304
- 2026-10-03 Alias added: GHSA-v82p-wrg2-wj3m
References
More Siemens Cp-8000 Master Module With I/o -25/+70 Firmware vulnerabilities
- TI-2021-20383 Hard-coded credentials in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C CVSS 3.1HIGH 8.8
- TI-2021-20384 Improper access control in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C CVSS 3.1HIGH 7.5
Sources
- CVE-2021-46304 · CVE Program
- CVE-2021-46304 · NVD
- FIRST EPSS
- GHSA-v82p-wrg2-wj3m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences